{"id":69513,"date":"2020-02-20T06:38:30","date_gmt":"2020-02-20T03:38:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen"},"modified":"2020-03-03T16:14:51","modified_gmt":"2020-03-03T13:14:51","slug":"vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","title":{"rendered":"Cump\u0103r\u0103 pentru regin\u0103: Varonis investigheaz\u0103 ransomware-ul rapid de r\u0103sp\u00e2ndire \u201cSaveTheQueen\u201d","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Cump\u0103r\u0103 pentru regin\u0103: Varonis investigheaz\u0103 ransomware-ul rapid de r\u0103sp\u00e2ndire \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/3b555cf5fad7a1472b9db7a26a736f57.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <br \/>\nUn nou tip de malware de tip ransomware cripteaz\u0103 fi\u0219ierele \u0219i le adaug\u0103 extensia \".SaveTheQueen\", r\u0103sp\u00e2ndindu-se prin folderul de re\u021bea SYSVOL de pe controlerele de domeniu Active Directory.<\/p>\n<p>Clien\u021bii no\u0219tri s-au confruntat recent cu aceast\u0103 amenin\u021bare. Mai jos prezent\u0103m analiza noastr\u0103 complet\u0103, rezultatele \u0219i concluziile.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>\n<h2>Detectare<\/h2>\n<\/h2>\n<p>\nUnul dintre clien\u021bii no\u0219tri ne-a contactat dup\u0103 ce s-au confruntat cu un nou tip de ransomware care ad\u0103uga extensia \".SaveTheQueen\" la noile fi\u0219iere criptate \u00een mediu lor.<\/p>\n<p>\u00cen timpul anchetei noastre, \u00een etapa de identificare a surselor de infec\u021bie, am descoperit c\u0103 r\u0103sp\u00e2ndirea \u0219i urm\u0103rirea victimelor infectate au fost realizate prin utilizarea <strong>folderului de re\u021bea SYSVOL <\/strong> de pe controlerul de domeniu al clientului.<\/p>\n<p>SYSVOL este un folder esen\u021bial pentru fiecare controler de domeniu, folosit pentru livrarea obiectelor de politici de grup (GPO) \u0219i a scripturilor de logare \u0219i delogare pe computerele din domeniu. Con\u021binutul acestui folder este replicat \u00eentre controlerele de domeniu pentru sincronizarea acestor date pe site-urile organiza\u021biei. Scrierea \u00een SYSVOL necesit\u0103 privilegii \u00eenalte de domeniu, \u00eens\u0103, dup\u0103 compromiterea sa, acest activ devine un instrument puternic pentru atacatori, care pot folosi acest lucru pentru a r\u0103sp\u00e2ndi rapid \u0219i eficient malware-ul \u00een domeniu.<\/p>\n<p>Lan\u021bul de audit Varonis a ajutat la identificarea rapid\u0103 a urm\u0103toarelor:<\/p>\n<ul>\n<li> Contul de utilizator infectat crea un fi\u0219ier numit \u201ehourly\u201d \u00een SYSVOL<\/li>\n<li> Multe fi\u0219iere de jurnal au fost create \u00een SYSVOL \u2013 fiecare numit dup\u0103 dispozitivul din domeniu<\/li>\n<li>Multe adrese IP diferite au avut acces la fi\u0219ierul \u201ehourly\u201d<\/li>\n<\/ul>\n<p>\nAm concluzionat c\u0103 fi\u0219ierele de jurnal au fost utilizate pentru a urm\u0103ri procesul de infec\u021bie pe dispozitivele noi, \u0219i c\u0103 \u201ehourly\u201d este o sarcin\u0103 programat\u0103 care executa malware-ul pe noile dispozitive, utiliz\u00e2nd scriptul Powershell \u2013 mostrele \u201ev3\u201d \u0219i \u201ev4\u201d.<\/p>\n<p>Probabil c\u0103 atacatorul a ob\u021binut \u0219i a folosit privilegii de administrator de domeniu pentru a scrie fi\u0219iere \u00een SYSVOL. Pe nodurile infectate, atacatorul rula cod PowerShell, care crea o sarcin\u0103 programat\u0103 pentru a deschide, decripta \u0219i lansa malware-ul.<\/p>\n<h2>\n<h2>Decriptarea malware-ului<\/h2>\n<\/h2>\n<p>\nAm \u00eencercat f\u0103r\u0103 succes mai multe metode de decriptare a mostrelor:<\/p>\n<p><img decoding=\"async\" alt=\"Cump\u0103r\u0103 pentru regin\u0103: Varonis investigheaz\u0103 ransomware-ul rapid de r\u0103sp\u00e2ndire \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/1473714dab68c4c046e057012bf27632.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nEram aproape s\u0103 ne pred\u0103m c\u00e2nd am decis s\u0103 \u00eencerc\u0103m metoda \u201eMagic\u201d minunat\u0103<br \/>\nutilitar <noindex><a rel=\"nofollow\" href=\"https:\/\/gchq.github.io\/CyberChef\/\">Cyberchef<\/a><\/noindex> de la GCHQ. \u201eMagic\u201d \u00eencearc\u0103 s\u0103 ghiceasc\u0103 criptarea fi\u0219ierului, utiliz\u00e2nd o abordare brut\u0103 pentru diferite tipuri de criptare \u0219i m\u0103sur\u00e2nd entropia. <\/p>\n<p><b class=\"spoiler_title\">Nota traduc\u0103torului<\/b> Vezi.<noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%94%D0%B8%D1%84%D1%84%D0%B5%D1%80%D0%B5%D0%BD%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D0%B0%D1%8F_%D1%8D%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F\">Entropia diferen\u021bial\u0103<\/a><\/noindex> \u0219i <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%AD%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F#%D0%92_%D1%82%D0%B5%D0%BE%D1%80%D0%B8%D0%B8_%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%B8\">Entropia \u00een teoria informa\u021biei<\/a><\/noindex>. Acest articol \u0219i comentariile nu implic\u0103 discu\u021bii din partea autorilor despre detaliile metodelor utilizate, at\u00e2t \u00een software-ul open-source, c\u00e2t \u0219i \u00een cel proprietary. <br \/>\n<img decoding=\"async\" alt=\"Cump\u0103r\u0103 pentru regin\u0103: Varonis investigheaz\u0103 ransomware-ul rapid de r\u0103sp\u00e2ndire \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/af405d7c71cc799f50d8a1e56a32dd3f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u201eMagic\u201d a determinat c\u0103 s-a folosit un pachet GZip cu codificare base64, ceea ce ne-a permis s\u0103 extragem fi\u0219ierul \u0219i s\u0103 descoperim codul de inserare \u2013 \u201einjectorul\u201d.<\/p>\n<p><img decoding=\"async\" alt=\"Cump\u0103r\u0103 pentru regin\u0103: Varonis investigheaz\u0103 ransomware-ul rapid de r\u0103sp\u00e2ndire \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/5f7ff7505b607fc502f24fe5cbe6ba61.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> Dropper: \u201e\u00cen regiune, epidemie! Vaccin\u0103ri \u00een mas\u0103. Pesta\u201d<\/h2>\n<p>\nDropperul era un fi\u0219ier .NET obi\u0219nuit f\u0103r\u0103 nicio protec\u021bie. Dup\u0103 ce am citit codul surs\u0103 cu ajutorul <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/0xd4d\/dnSpy\">DNSpy<\/a><\/noindex> , ne-am dat seama c\u0103 singurul s\u0103u scop era s\u0103 injecteze cod shell \u00een procesul winlogon.exe.<\/p>\n<p><img decoding=\"async\" alt=\"Cump\u0103r\u0103 pentru regin\u0103: Varonis investigheaz\u0103 ransomware-ul rapid de r\u0103sp\u00e2ndire \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/539b3ddb63bad6d3ebc48993462db135.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Cump\u0103r\u0103 pentru regin\u0103: Varonis investigheaz\u0103 ransomware-ul rapid de r\u0103sp\u00e2ndire \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/3135f51dcd9534c0a11a9a0dcf01bc0d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Cod shell sau simple dificult\u0103\u021bi<\/h2>\n<p>\nAm folosit un instrument de autori Hexacorn \u2013 <noindex><a rel=\"nofollow\" href=\"http:\/\/www.hexacorn.com\/blog\/2015\/12\/10\/converting-shellcode-to-portable-executable-32-and-64-bit\/\">shellcode2exe<\/a><\/noindex> pentru a \u201ecompila\u201d codul shell \u00eentr-un fi\u0219ier executabil pentru depanare \u0219i analiz\u0103. Apoi am descoperit c\u0103 func\u021biona at\u00e2t pe ma\u0219ini de 32 de bi\u021bi, c\u00e2t \u0219i pe cele de 64 de bi\u021bi.<\/p>\n<p><img decoding=\"async\" alt=\"Cump\u0103r\u0103 pentru regin\u0103: Varonis investigheaz\u0103 ransomware-ul rapid de r\u0103sp\u00e2ndire \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/df319bd4fa849be9e0afc0f4be5fe753.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nScrierea chiar \u0219i a unui simplu cod shell \u00een transla\u021bie nativ\u0103 cu asamblorul poate fi complicat\u0103, iar realizarea unui cod shell complet care s\u0103 func\u021bioneze pe ambele tipuri de sisteme necesit\u0103 aptitudini de elit\u0103, a\u0219a c\u0103 am \u00eenceput s\u0103 ne mir\u0103m de sofisticarea atacatorului.<\/p>\n<p>C\u00e2nd am descompus codul shell compilat cu ajutorul <noindex><a rel=\"nofollow\" href=\"https:\/\/x64dbg.com\/\">x64dbg<\/a><\/noindex>, am observat c\u0103 \u00eenc\u0103rca <strong> biblioteci dinamice .NET <\/strong>, cum ar fi clr.dll \u0219i mscoreei.dll. Asta ni s-a p\u0103rut ciudat \u2013 \u00een mod obi\u0219nuit, atacatorii \u00eencearc\u0103 s\u0103 fac\u0103 codul shell c\u00e2t mai mic posibil, apel\u00e2nd la func\u021bii native ale OS-ului \u00een loc de a le \u00eenc\u0103rca. <em>De ce ar avea cineva nevoie s\u0103 \u00eencorporeze \u00een codul shell func\u021bionalit\u0103\u021bi Windows, \u00een loc de un apel direct la cerere? <\/em><\/p>\n<p>A\u0219a cum s-a dovedit, autorul amenin\u021b\u0103rii nu a scris deloc acest cod shell complex \u2013 s-a folosit un software caracteristic pentru aceast\u0103 sarcin\u0103 pentru a traduce fi\u0219ierele executabile \u0219i scripturile \u00een cod shell. <\/p>\n<p>Am g\u0103sit instrumentul <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/TheWover\/donut\">Donut<\/a><\/noindex>, care, ne-a p\u0103rut, ar putea compila un cod shell similar. Iat\u0103 descrierea sa de pe GitHub:<\/p>\n<p><em>Donut genereaz\u0103 cod shell x86 sau x64 din VBScript, JScript, EXE, DLL (inclusiv asambl\u0103ri .NET). Acest cod shell poate fi injectat \u00een orice proces Windows pentru a fi executat.<br \/>\nde memorie RAM.<\/em><\/p>\n<p>Pentru a ne confirma teoria, am compilat propriul nostru cod folosind Donut \u0219i l-am comparat cu un exemplu \u2013 \u0219i\u2026 da, am descoperit \u00eenc\u0103 un component al uneltelor folosite. Dup\u0103 aceasta, am reu\u0219it s\u0103 extragem \u0219i s\u0103 analiz\u0103m fi\u0219ierul executabil original pe .NET.<\/p>\n<h2> Protec\u021bia codului <\/h2>\n<p>\nAcest fi\u0219ier a fost obfuscat folosind <noindex><a rel=\"nofollow\" href=\"https:\/\/yck1509.github.io\/ConfuserEx\/\">ConfuserEx<\/a><\/noindex>:<\/p>\n<p><img decoding=\"async\" alt=\"Cump\u0103r\u0103 pentru regin\u0103: Varonis investigheaz\u0103 ransomware-ul rapid de r\u0103sp\u00e2ndire \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/573d8e66ce3bdf8723201646d374a4cd.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Cump\u0103r\u0103 pentru regin\u0103: Varonis investigheaz\u0103 ransomware-ul rapid de r\u0103sp\u00e2ndire \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/cf94a7938184c72864acb8a8d81e8475.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nConfuserEx este un proiect .NET cu surs\u0103 deschis\u0103 pentru protec\u021bia codului altor dezvolt\u0103ri. Acest tip de software permite dezvoltatorilor s\u0103-\u0219i protejeze codul \u00eempotriva ingineriei inverse prin metode precum: \u00eenlocuirea simbolurilor, mascare a fluxului de comenzi \u0219i ascunderea metodei de referin\u021b\u0103. Autorii de malware folosesc obfuscatori pentru a evita detectarea \u0219i pentru a complica procesul de inginerie invers\u0103.<\/p>\n<p>Datorit\u0103 <noindex><a rel=\"nofollow\" href=\"https:\/\/drive.google.com\/file\/d\/1cXHTHH1S90RCqWYnFOSp1rtYmURecQVm\/view\">ElektroKill Unpacker<\/a><\/noindex> am decomprimat codul:<\/p>\n<p><img decoding=\"async\" alt=\"Cump\u0103r\u0103 pentru regin\u0103: Varonis investigheaz\u0103 ransomware-ul rapid de r\u0103sp\u00e2ndire \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/03249d2b493027354396894cf9710041.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> Rezultatul \u2013 payload-ul<\/h2>\n<p>\nPayload-ul rezultat \u00een urma transform\u0103rilor este un virus-ransomware foarte simplu. F\u0103r\u0103 niciun mecanism de men\u021binere \u00een sistem, f\u0103r\u0103 conexiuni cu centrul de comand\u0103 \u2013 doar vechiul \u0219i bunul criptare asimetric\u0103, pentru a face datele victimei ilizibile.<\/p>\n<p>Func\u021bia principal\u0103 alege ca parametrii urm\u0103toarele \u0219iruri:<\/p>\n<ul>\n<li> Extensia fi\u0219ierului de utilizat dup\u0103 criptare (SaveTheQueen) <\/li>\n<li> Email-ul autorului, pentru a fi inclus \u00een fi\u0219ierul-noti\u021b\u0103 cu cererea de r\u0103scump\u0103rare<\/li>\n<li> Cheia public\u0103 folosit\u0103 pentru criptarea fi\u0219ierelor <\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Cump\u0103r\u0103 pentru regin\u0103: Varonis investigheaz\u0103 ransomware-ul rapid de r\u0103sp\u00e2ndire \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/51b7194260b58e26636b5cbe1e9cdb28.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<strong>Procesul arat\u0103 astfel:<\/strong><\/p>\n<ol>\n<li> Malware-ul investigheaz\u0103 discurile locale \u0219i conectate la dispozitivul victimei\n<p><img decoding=\"async\" alt=\"Cump\u0103r\u0103 pentru regin\u0103: Varonis investigheaz\u0103 ransomware-ul rapid de r\u0103sp\u00e2ndire \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/ca93bce285bdcf05cd9f7f52bac78f25.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> Caut\u0103 fi\u0219iere de criptat\n<p><img decoding=\"async\" alt=\"Cump\u0103r\u0103 pentru regin\u0103: Varonis investigheaz\u0103 ransomware-ul rapid de r\u0103sp\u00e2ndire \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/e9790631b12dbf816a2c728c2267f1b0.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> \u00cencerc\u0103 s\u0103 finalizeze procesul care folose\u0219te fi\u0219ierul ce urmeaz\u0103 a fi criptat<\/li>\n<li> Renume\u0219te fi\u0219ierul \u00een \u00abNumele_original_al_fi\u0219ierului.SaveTheQueenING\u00bb, utiliz\u00e2nd func\u021bia MoveFile, \u0219i \u00eel cripteaz\u0103 <\/li>\n<li>Dup\u0103 ce fi\u0219ierul este criptat cu cheia public\u0103 a autorului, malware-ul \u00eel redenume\u0219te din nou, acum \u00een \"Numele_original_al_fi\u0219ierului.SaveTheQueen\".<\/li>\n<li>Se scrie un fi\u0219ier cu cererea de r\u0103scump\u0103rare \u00een aceea\u0219i dosar\n<p><img decoding=\"async\" alt=\"Cump\u0103r\u0103 pentru regin\u0103: Varonis investigheaz\u0103 ransomware-ul rapid de r\u0103sp\u00e2ndire \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/c79df5ec0e714d9df01130a40b241f60.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<\/ol>\n<p>\nBaz\u00e2ndu-se pe utilizarea func\u021biei native \u00abCreateDecryptor\u00bb, una dintre func\u021biile malware-ului pare s\u0103 con\u021bin\u0103 ca parametru un mecanism de decriptare ce necesit\u0103 cheia privat\u0103.<\/p>\n<p>Virusul de criptare <strong>NU cripteaz\u0103 fi\u0219ierele<\/strong>, care sunt stocate \u00een directoare:<\/p>\n<p>C:windows<br \/>\nC:Program Files<br \/>\nC:Program Files (x86)<br \/>\nC:Users\\AppData<br \/>\nC:inetpub<\/p>\n<p>De asemenea, el <strong>NU cripteaz\u0103 urm\u0103toarele tipuri de fi\u0219iere:<\/strong>EXE, DLL, MSI, ISO, SYS, CAB.<\/p>\n<h2>\n<h2> Concluzii \u0219i rezultate<\/h2>\n<\/h2>\n<p>\nDe\u0219i virusul ransomware \u00een sine nu avea func\u021bii neobi\u0219nuite, atacatorul a folosit creativ Active Directory pentru a r\u0103sp\u00e2ndi dropper-ul, iar software-ul r\u0103u inten\u021bionat ne-a oferit obstacole interesante, de\u0219i \u00een cele din urm\u0103 nu foarte complexe, \u00een timpul analizei. <\/p>\n<p>Credem c\u0103 autorul malware-ului:<\/p>\n<ol>\n<li>A scris ransomware-ul cu o integrare \u00eencorporat\u0103 \u00een procesul winlogon.exe, precum \u0219i<br \/>\nfunc\u021bionalitatea de criptare \u0219i decriptare a fi\u0219ierelor<\/li>\n<li>A mascat codul r\u0103u inten\u021bionat folosind ConfuserEx, a transformat rezultatul cu ajutorul Donut \u0219i a ascuns suplimentar dropper-ul \u00een base64 Gzip<\/li>\n<li>A ob\u021binut privilegii sporite \u00een domeniul victimei \u0219i le-a folosit pentru a copia<br \/>\nmalware-ul criptat \u0219i sarcini programate \u00een folderul de re\u021bea SYSVOL al controlerilor de domeniu<\/li>\n<li>A lansat un script PowerShell pe dispozitivele din domeniu pentru a r\u0103sp\u00e2ndi malware-ul \u0219i a \u00eenregistra progresul atacului \u00een jurnalele din SYSVOL<\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"Cump\u0103r\u0103 pentru regin\u0103: Varonis investigheaz\u0103 ransomware-ul rapid de r\u0103sp\u00e2ndire \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/8419072a20487e5a7a3ff20862759f53.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDac\u0103 ave\u021bi \u00eentreb\u0103ri despre aceast\u0103 variant\u0103 de ransomware sau despre oricare alt\u0103 activitate desf\u0103\u0219urat\u0103 de echipele noastre de forenzic\u0103 \u0219i investigare a incidentelor de securitate cibernetic\u0103, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/company\/contact-us\/\">contacta\u021bi-ne <\/a><\/noindex> sau solicita\u021bi <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/cyber-workshop\/\">o demonstra\u021bie live a reac\u021biei la atacuri<\/a><\/noindex>, unde \u00eentotdeauna r\u0103spundem la \u00eentreb\u0103ri \u00een cadrul unei sesiuni de \u00eentreb\u0103ri \u0219i r\u0103spunsuri.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/488896\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u043e\u0432\u0430\u044f \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043a\u043b\u0430\u0441\u0441\u0430 \u0432\u0438\u0440\u0443\u0441\u043e\u0432-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043a \u043d\u0438\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 &quot;.SaveTheQueen&quot;, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044f\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0443\u044e \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u043f\u0430\u043f\u043a\u0443 SYSVOL \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Active Directory. \u041d\u0430\u0448\u0438 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u044d\u0442\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043e\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e. \u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u043d\u0430\u0448 \u043f\u043e\u043b\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437, \u0435\u0433\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438 \u0432\u044b\u0432\u043e\u0434\u044b \u043d\u0438\u0436\u0435. \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u041e\u0434\u0438\u043d \u0438\u0437 \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432 \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 \u043d\u0430\u043c\u0438 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043e\u043d\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":69514,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-69513","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-20T03:38:30+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:14:51+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47R\u0103scump\u0103r\u0103 \u2014 a\u0219a cum se cuvinte reginei: Varonis investigheaz\u0103 ransomware-ul \u201eSaveTheQueen\u201d, care se r\u0103sp\u00e2nde\u0219te rapid | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-20T03:38:30+00:00","article:modified_time":"2020-03-03T13:14:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"69513","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:21:24","updated":"2022-10-08 01:25:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/69513","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=69513"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/69513\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/69514"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=69513"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=69513"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=69513"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}